On July 15, 2004 01:41 pm, robbrown27709@xxxxxxxxxxx wrote: > I have a user who claims he did the following: > cp -r /u02/stuff /u102 > cd /u102/stuff > rm * > cd /u102 > rmdir stuff > He claims that the stuff directory was removed from both /u02 & /u102. I > tried to recreate this, but every time I do, it works correctly; only > /u102/stuff is removed & /u02/stuff is intact. This guy is a very reputable > DBA and everyone believes him. I am the Unix admin & I must explain this to > the boss. I can't explain this. I have never seen anything like this. Is > this possible? Any thoughts or comments? The following is the config: > /dev/cciss/c1d0p12 /u02 > /dev/cciss/c1d1p2 /u102 > Thanks in advance for any comments. > -Robert Brown Hi, I agree with looking at the history file, but you need to know that it can be misleading. First, although it would not likely come into play here, when multiple logins or teminals are run for a single user, the history file will vary between terminals because it is written when you close that shell. Also, you can uparrow and overwrite a history item. O condider if someone was more interested in saving face than in resolving what really happened, they could do something like this: pete@nebula temp$ history|grep [x]yz pete@nebula temp$ touch xyz pete@nebula temp$ history|grep [x]yz 199 touch xyz pete@nebula temp$ rm xyz pete@nebula temp$ history|grep [x]yz 199 touch xyz 201 rm xyz pete@nebula temp$ history -d 201 pete@nebula temp$ history|grep [x]yz 199 touch xyz pete@nebula temp$ so maybe include a: history|grep "history -d" -- Pete Nesbitt, rhce -- redhat-list mailing list unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe https://www.redhat.com/mailman/listinfo/redhat-list
